CVE-2025-4999 is a medium severity (CVSS 6.3) command injection flaw in Linksys FGW3000-AH and FGW3000-HK routers running firmware up to 1.0.17.000000. The supplicant_rnd_id_en argument in the sub_4153FC function of /cgi-bin/sysconf.cgi reaches a system command. The vendor did not respond to the reporter, and no fixed firmware is confirmed.
What's affected
Linksys FGW3000-AH and FGW3000-HK, firmware up to and including 1.0.17.000000, per the record. The flaw sits in the HTTP POST request handler of the web management interface, in the function sub_4153FC of /cgi-bin/sysconf.cgi. The record describes the attack as remote and says the exploit has been disclosed to the public.
The record states that the vendor was contacted early but did not respond in any way. It lists no fixed firmware and no vendor advisory. The sibling issue CVE-2025-5000 affects the same models through a different argument, so checking one without the other leaves a gap.
The CVSS vector in the record shows low privileges required, which means the attacker needs some level of access to the management interface first. That is why the score is medium and not higher, but it is a poor reason to leave the page exposed.
How to check if you're exposed
Open the router's admin page and read the firmware version on the status or administration screen. Anything at or below 1.0.17.000000 on these two models is in the affected range.
Then find out whether the management interface is reachable from the internet. From a machine outside your network, scan only your own public address:
nmap -Pn -p 80,443,8080,8443 --open YOUR.PUBLIC.IP.ADDRESS
If any of those ports answer with the router's login page, remote management is on and should be turned off. Only scan addresses you own or have permission to test.
What to do now
- List every FGW3000-AH and FGW3000-HK in your estate, including units supplied by an internet provider.
- Turn off remote administration from the internet and allow management only from the local network.
- Change the admin password if it is still a default, and use a unique one.
- Check Linksys support pages and your provider for a firmware newer than 1.0.17.000000, since the record does not confirm one.
- If the device cannot be fixed and sits on a sensitive network, plan a replacement with a model the vendor still supports.
Why it matters
The weakness is CWE-77, with its parent class CWE-74. A value sent to the web interface is placed into an operating system command without being cleaned, so the router may run commands the author never intended. On a router, that means control of the device that sits in front of every other system on the network.
Consumer and small office routers rarely get automatic updates, and a vendor that does not answer a disclosure makes a fix less likely. That puts the burden on the owner: reduce who can reach the management page, and replace hardware that stays unpatched. The flaw is not marked as exploited in the wild, since the record's KEV flag is false.
Quick check
Is there a firmware fix for CVE-2025-4999?
None is confirmed in the record, and the vendor is recorded as not responding to the report. Check Linksys support for newer firmware and keep remote management off.
Does the medium score mean I can ignore it?
No. The score reflects the access the attacker needs. If the management page is exposed to the internet or shared networks, the practical risk is higher than the number suggests.
Sources
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
